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Executive Summary 

Background 

Controlled substances include narcotics, stimulants, depressants, and hallucinogens. Due to the abuse potential and risk associated with these drugs, the 
U.S. Department of Justice (DOJ) and the Drug Enforcement Agency (DEA) developed regulatory requirements governing their manufacture, distribution 
and dispensing. These requirements include special handling, inventory controls, and documentation requirements. Additionally, the DEA Office of 
Diversion Control released a series of “significant documents” which include a practitioner manual and pharmacist manual that further outlines elements of 
the CSA and procedures to appropriately comply. 

The Department of Pharmacy Services (Pharmacy) is responsible for ensuring compliance with all regulatory requirements in regards to the handling of 
controlled substances within the University of Texas Southwestern Medical Center (Medical Center) hospitals and clinics. Each pharmacy location holds 
its own license with the Texas State Board of Pharmacy (TSBP), DEA, and the Department of Public Safety (DPS). 

Pharmacy provides integrated pharmaceutical services to the Medical Center hospitals and clinics. In addition to the traditional medication dispensing 
functions. Pharmacy offers daily clinical services, hospitalist services and annual training for over 20 pharmacy students and three residents. The 
Department has a central pharmacy at each hospital that manages the dispensing of medications for hospital patients; three clinic pharmacies that supply 
medications for patients receiving cancer treatment; and two retail pharmacies that dispense medications to customers as prescribed by their provider: 

• Clements University Hospital Central Pharmacy 

• Zale Lipshy University Hospital Central Pharmacy and OR Satellite Pharmacy 

• Ashton Infusion Center Pharmacy 

• Simmons Cancer Center Infusion Pharmacy 

• Simmons Cancer Center Infusion Pharmacy at Richardson/Plano 

• Simmons Cancer Center Retail Pharmacy 

• Campus Retail Pharmacy at Aston Center 

The Pyxis CllSafe System (CllSafe) is the central storage for all controlled substances and is used to track and monitor controlled substance inventory at 
the central pharmacies. Pyxis MedStations (Pyxis) are automated dispensing units located throughout the hospitals and clinics. Controlled substances 
from the CllSafe are distributed to Pyxis as needed. CllSafe and Pyxis are equipped with the necessary features to handle controlled substances; 
including username and fingerprint access, inventory, receiving, dispensing, return, disposal and audit trails of all activities performed. Pyxis are not used 
at the retail pharmacy locations. Instead, certain controlled substances with higher potential for abuse are stored in locked cabinets. See Appendix B for 
statistics on the volume of controlled substances inventory on hand as of December 31,2014. 


Scope and Objectives 

The Medical Center Office of Internal Audit has completed its Pharmacy Controlled Substances Audit. This was an operational risk based audit and part of 
the fiscal year 2015 Audit Plan. 

The audit scope included processes related to the overall handling of controlled substances and activities from May 1, 2014 to December 31, 2014. The 
review included all hospital, clinic and retail pharmacy locations with controlled substances inventory. Controlled substances in ambulatory clinics, animal 
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Executive Summary 

research and clinical research locations were not included in the scope of this audit but will be reviewed separately. Audit procedures included interviews 
with stakeholders, review of policies and procedures and other documentation, data analytics and substantive testing. 


We conducted our examination according to guidelines set forth by the Institute of Internal Auditors’ International Standards for the Professional Practice 
of Internal Auditing. 


The primary objectives of the audit were to determine whether: 

• Controlled substances are stored and safeguarded in compliance with the federal regulations and Medical Center policies. 

• Appropriate internal controls for the procurement of controlled substances are in place and are operating effectively. 

• Controlled substances transported between pharmacies or operational areas are appropriately approved and safeguarded. 

• Inventory monitoring procedures are in place to identify and resolve discrepancies and ensure regulatory discrepancy reporting is performed on a 
timely basis. 

• Wastage is physically safeguarded and properly destroyed or disposed. 

• The Medical Center is in compliance with DEA or other requirements and internal policies. 

Conclusion 


Included in the table below is a summary of the observations noted, along with the respective disposition of these observations within the Medical Center 
internal audit risk definition and classification process. See Appendix A for Risk Rating Classifications and Definitions. 


Medium/High (1) 


Medium (3) 


Low (2) 


Total (7) 


Specific strengths identified during the audit include: 

• Pharmacy operations were well documented and compliant with federal regulations. 

• Licensing with the DEA, TSBP and DPS for operating and ordering controlled substances is current and appropriate. 

• Controlled substances storage is compliant with federal regulations and Medical Center policies at the hospitals and clinics. 

• Controlled substances transported between pharmacies or operational areas were supported by evidence of sufficient review and safeguarding. 

There was one significant (high risk) issue identified related to Physical Security Access. Other key improvement opportunities risk-ranked as 
medium/high and medium are also summarized below. 

• Physical Security Access - Badge access, punch code access and key access to physical locations is not adequate to prevent loss or theft of 
controlled substances. Previous diversion incident of Schedule II drugs was identified due to lack of monitoring and security measures. 

• Discrepancies Resolution - Discrepancies (i.e. where controlled substance inventory on hand does not agree to system totals) were not resolved 
timely which could result in undetected diversion. 
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Executive Summary 

• Pyxis Station System Access Review - A process was not in place to review the appropriateness of employees assigned Pyxis access. 

• Physicai Wastage - The process to dispose of liquid controlled substances at the Clements and Zale Lipshy hospitals is not in compliance with 
Environmental Protection Agency (EPA) guidelines. Additionally, the process for disposal of tablets and patches could result in diversion. 

• Retaii inventory Monitoring - Procedures were found to have control gaps for ensuring accurate controlled substance inventory records at the retail 
locations. 

Management has plans to address the issues identified in the report and in some cases have already implemented corrective actions. These responses, 
along with additional details for the key improvement opportunities listed above and other lower risk observations are listed in the Detailed Observations 
and Action Plans Matrix (Matrix) section of this report. 

We would like to take the opportunity to thank the departments and individuals included in this audit for the courtesies extended to us and for their 
cooperation during our review. 


Sincerely, 



Valla Wilson, Assistant Vice President for Internal Audit 

Audit Team: 

Angeliki Marko, Senior Internal Auditor 

Jessica Grigsby, Senior Internal Auditor 

Yasemin Polat, Auditor II 

Kelly Iske, Manager of Internal Audit 

Tim LaChiusa, Assistant Director of Internal Audit 

Valla Wilson, Assistant Vice President for Internal Audit 

Cc: Brian Cohen, Director of Pharmacy Services, University Hospitals & Clinics 

Kelly Monroe, Manager of Pharmacy Operations, Retail Pharmacies 
Kyle Kerr, Manager of Pharmacy Operations, University Hospitals & Clinics 
Jeff Liticker, Manager of Pharmacy Operations, University Hospitals & Clinics 
William Tharpe, Manager of Clinical Pharmacy, University Hospitals & Clinics 
Michael Medina, Associate Vice President of Ancillary Services, University Hospitals & Clinics 
Becky McCulley, Chief Operating Officer, University Hospitals & Clinics 
John Warner, M.D., Chief Executive Officer, University Hospitals & Clinics 
Bruce Meyer, M.D., Executive Vice President, Health System Affairs 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: High * 

1. improve Physicai Security Access for Controiied 
Substances 

Physical access to pharmacy and Pyxis station 
locations, and cabinets securing Schedule II drugs, 
is not adequate to prevent loss or theft of controlled 
substances. 

• Simmons Cancer Center & Retaii: 

o Access is controlled through key punch 
codes and door keys assigned to Pharmacy 
personnel. Pharmacy management 
requested removal of the generic key punch 
master code that allows access to an 
unknown number of people with knowledge 
of the code. 

o A diversion of approximately 2,340 

Schedule II drugs occurred during July and 
August 2014 as a result of inadequate 
physical security and monitoring controls. 

The diversion was appropriately reported to 
the applicable authorities. 

• Aston Retail: 

o Access is controlled by assigned door keys. 
The main door should remain locked to 
control access to only authorized Pharmacy 
personnel, however current practice is to 
leave the door propped open during 
business hours. Installation of a badge 
reader access system is planned in the near 
future. 

o Access to the cabinet securing Schedule II 
drugs is controlled by keys assigned only to 
the Pharmacists. The cabinet was observed 
standing open and unlocked during 

1. Determine the appropriate physical access 
authorities for pharmacy and non-pharmacy 
personnel regarding the punch code. 

2. Determine the appropriate physical access 
authorities for pharmacy and non-pharmacy 
personnel regarding key access. 

3. Determine the appropriate physical access 
authorities for pharmacy and non-pharmacy 
personnel regarding badge access. 

4. Establish a process to periodically review 
physical access to the pharmacy areas 
monthly in order to identify and correct 
inappropriate access for badges, punch 
codes and keys. 

Management Action Plans: 

1. Badge access is approved and will replace 
punch code access at the Simmons Cancer 
Center retail and infusion pharmacies. 

2. The door to enter the Aston Retail Pharmacy is 
now kept shut at all times. The Schedule II 
cabinet within the Ashton Retail Pharmacy is 
now locked at all times and accessible only to 
the pharmacists with assigned keys. The spare 
key is now kept in a box with a combination 
lock. 

3. The Associate VP Ancillary Services will 
coordinate with the Campus Police Department 
to establish the appropriate level of access for 
officers to pharmacy locations. 

4. The Pharmacy Director will request a listing of 
badge access and badge activity reports 
monthly from the Police Department Access 
Control Manager in order to review and correct 
inappropriate access. 

Action Plan Owners: 

1. Simmons Cancer Center Pharmacy Manager 

2. Retail Pharmacies Operations Manager 

3. Associate VP Ancillary Services 

4. Pharmacy Director 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

business hours. Additionally, an extra key to 
the cabinet was kept at an unsecured area 
accessible by anyone within the pharmacy. 

• Clements, Zale Lipshy, Aston Infusion 

Clinic, Richardson/Plano Clinic: Access is 
controlled by badge access. Analysis revealed: 

o 71 employees at Clements, 84 at Zale 

Lipshy, 69 at Aston Infusion and five at 
Richardson had inappropriate access 
because they were either terminated or 
employed by another department. 

o Two Shred It vendor employees have badge 
access. 

o Campus Police Officers also have 
unrestricted access to enter pharmacy 
locations. 

Pharmacy management has requested the 
removal of the inappropriate access rights. 

There was not a process in place for 
management to periodically review badge 
access reports. 


Target Completion Dates: 

1. March 31, 2015 

2. Completed 

3. March 31, 2015 

4. March 31, 2015 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: Medium/High ^ 

2. improve Discrepancy Resoiution Process 

Discrepancies were not consistently resolved in a 
timely manner. A discrepancy occurs when there 
are inconsistencies in patient information, incorrect 
inventory counts, or incomplete provider records for 
transactions involving controlled substances. 

Analysis of 1,244 discrepancies generated over the 
course of 90 days revealed: 

• 236 (18%) general Pyxis discrepancies were 
not resolved within the 24 hour timeframe as 
required by policy. 

• 60 (5%) general Pyxis discrepancies remained 
unresolved. 

• 66 (5%) operating room Pyxis station 
discrepancies were not resolved within the 72 
hour timeframe as required by policy. 

In addition. Anesthesiologists and operating room 
users create about 70 discrepancies per month but 
are not resolving their own discrepancies as 
required by Pharmacy policy. Instead, central 
pharmacy personnel follow up to resolve these 
discrepancies causing unnecessary delays. 
Additionally, documentation by the central 
pharmacy was not signed and dated to support the 
timeliness of their discrepancy resolution. 

Delays in resolving discrepancies increase the risk 
that controlled substances diversion will not be 
detected. 

1. Establish a process to retrain nurses and 
providers on how to use the Pyxis stations to 
resolve discrepancies. 

2. Establish a process to ensure 

Anesthesiology providers take accountability 
to resolve their discrepancies. Also consider 
having a designated individual perform on 
site reviews and random visits at the 
operating room areas to improve the 
discrepancy resolution process. 

3. Include the dates and name of the reviewer 
in all resolution documentation for 
Anesthesiology discrepancies. 

Management Action Plans: 

1. The Pharmacy Director will collaborate with the 
Nursing Educators and Pyxis team to retrain 
nurses and providers on proper discrepancy 
resolution procedures and timeliness 
standards. In addition, laminated instruction 
cards will be made available at each Pyxis for 
user reference. 

2. The Associate VP, Chief Operations Officer will 
coordinate with the Chair of Anesthesiology and 
Pain Management to ensure proper 
accountability for discrepancy resolution is 
established. 

3. The OR Technician Coordinator is now signing 
and dating all resolution documentation. 

Action Plan Owners: 

1. Pharmacy Director 

2. Associate VP Chief Operations Officer 

3. OR Technician Coordinator 

Target Completion Dates: 

1. May 31,2015 

2. May 31,2015 

3. Completed 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: Medium 9 

3. Estabiish Pyxis Stations System Access Review 

A process was not in place to review the 
appropriateness of employees assigned Pyxis 
access. Current pharmacy procedures require 
employees to complete Pyxis training and a New 

User Pyxis form. Supervisors must verify, grant 
access, and return the form to the central pharmacy 
for review and filing. However, there was not a 
completed form on file for 15 of the 22 current 
employees tested. 

Without proper review. Pyxis access may not be 
granted appropriately and unauthorized employees 
may access controlled substances stored in the 

Pyxis stations. 

Reinforce the required record keeping process 
and establish a periodic review to ensure Pyxis 
access is provided only to employees who 
completed required training. 

Management Action Plans: 

The current procedures to forward New User Pyxis 
forms to central pharmacy will be reinforced. In 
addition, the Pharmacy Director will coordinate with 
the My Learning team to obtain a report to confirm 
required training has been completed by all new 

Pyxis users. He will also determine with the Pyxis 
team a report of users with the trail of who granted 
access can be obtained. 

Action Plan Owners: 

Pharmacy Director 

Target Completion Dates: 

May 31,2015. 

Risk Rating: Medium ^ 

4. improve Physicai Wastage Methods 

The processes to dispose of controlled substances 
at the Clements and Zale Lipshy hospitals need 
improvement. Management disclosed that liquid 
waste is disposed down the sink and tablets and 
patches are thrown in Sharps containers. Disposal 
of controlled substances down the sink is a violation 
of EPA guidelines. Disposal of tablets and patches 
in Sharps containers does not effectively safeguard 
controlled substances from diversion. 

A pilot program is in place at certain locations to 
appropriately dispose of controlled substances in 
compliance with EPA and DEA requirements. 

Expand the pilot program to all locations in order 
to manage controlled substance physical 
wastage in compliance with federal guidelines 
and protect against diversion. 

Management Action Plans: 

Pharmacy will be phasing in the pilot system waste 
receptacles over the next six months to 
approximately 70 areas. 

Action Plan Owners: 

Pharmacy Director 

Target Completion Dates: 

August 31,2015 


UTSW Medical Center Pharmacy Controlled Substances Audit 

Page 9 of 14 















ursouthwestern 

Medical Center 


Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: Medium 9 

5. Enhance Retaii inventory Monitoring 

Procedures 

Procedures were found to have control gaps for 
ensuring accurate controlled substance inventory 
records at the retail locations. The following was 
noted: 

• Procedures are not in place to review inventory 
adjustments for appropriateness. 

• At the Aston retail location, negative inventory 
balances were noted in the Pioneer Rx 
inventory system. Additionally, minor 
discrepancies between inventory balances on 
hand and system totals were identified. 

• Retail Pharmacy Management segregates and 
secures controlled substances removed from 
inventory for scheduled pickup by the return 
vendor. However, a reconciliation is not 
performed between controlled substances 
removed from inventory for return and the 
confirmation report from the vendor of items 
received. 

Lack of monitoring and reconciliation of controlled 
substance movement or inventory changes 
increases the risk of undetected diversion and 
inaccurate inventory records. 

1. Establish a process to monitor and reconcile 
all controlled substance movement in and 
out of the Pioneer Rx system at the 

Simmons Cancer Center retail and Aston 
retail pharmacies. 

2. Update the system inventory records to 
agree with inventory balances on shelf at 
Aston retail pharmacy. 

3. Establish a process to reconcile the 
controlled substances removed from Pioneer 
Rx system with the controlled substances 
picked up by the vendor at Simmons Cancer 
Center retail and Aston retail pharmacies. 

Management Action Plans: 

1. A Pioneer RX monthly drug movement report 
has been identified and is now being used to 
review changes and adjustments by drugs and 
users. 

2. The system inventory records for Aston Retail 
are now updated to reflect actual current 
inventory balances. Head Pharmacist will 
perform monthly inventory reviews to ensure 
records are accurate. 

3. A record will now be kept reconciling the 
controlled substances removed from Pioneer Rx 
with the controlled substances picked up by the 
vendor. 

Action Plan Owners: 

1. Retail Pharmacies Operations Manager 

2. Completed 

3. Aston Retail Pharmacist in Charge & Simmons 
Cancer Center Pharmacist in Charge 

Target Completion Dates: 

1. Completed 

2. Completed 

3. Completed 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: Low ^ 

6. Update Pharmacy Written Procedures 

Current Pharmacy controlled substance practices 
do not agree with some of the written procedures for 
the following: 

Re-evaluate and update the written procedures 
to reflect current practices, as necessary. 

Management Action Plans: 

Procedures will be updated as necessary to reflect 
current practices. The validation of wastage of 
controlled substances using the refractometer will 
be reestablished and will remain in the procedures. 

• Ordering and receiving at the Simmons Cancer 
Center pharmacies. 


Action Plan Owners: 

• Validation of wastage of controlled substances 
on a sample basis using the refractometer. 


Pharmacy Operations Manager 

• The DEA requirement for the timely reporting of 
loss or theft is not detailed in the written 
procedures. 


Target Completion Dates: 

August 31,2015 

Pharmacy controlled substances written policies 
and procedures have been in place since 2010 and 
some updates were performed in 2013. 



Without consistency of policies and procedures with 
the actual practices, processes performed may not 
be correct. 
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Detailed Observations and Action Plans Matrix 


Observation 

Recommendation 

Management Response 

Risk Rating: Low ^ 

7. improve Controiied Substance Receiving and 
Loading Processes 

Segregation of physical receiving and loading 
processes needs improvement. We identified the 
following: 

• At Aston Infusion clinic, a pharmacist signature 
is not always evidenced on the controlled 
substances invoices as required by policy. 

Ensure pharmacists at Aston Infusion and 
Simmons Cancer Center at Richardson/Plano 
verify controlled substances received and 
quantities loaded in the Pyxis stations match, by 
signing the invoices and performing an 
independent review. 

Management Action Plans: 

The Load report is now printed and both the 
pharmacist and another individual sign the invoice 
witnessing that all drugs were loaded into Pyxis. 

Action Plan Owners: 

Simmons Cancer Center Pharmacy Manager 

Aston Infusion Clinic Pharmacist in Charge 

• At Aston Infusion and Simmons Cancer Center 
at Richardson/Plano, the same individual who 
physically receives also loads the controlled 
substances into Pyxis. A load report is not 
printed in order for the Pharmacist to perform an 
independent review. 


Target Completion Dates: 

Completed 

These clinics have minimum quantities of controlled 
substances and inventory monitoring is performed 
by their supervising pharmacies. However, without 
an independent review of received orders, the 
possibility of loss or theft of controlled substances is 
increased. 
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Appendix A - Risk Classifications and Definitions 

As you review each observation within the Detailed Observations and Action Plans Matrix of this report, please note that we have included a 
color-coded depiction as to the perceived degree of risk represented by each of the observations identified during our review. The following 
chart is intended to provide information with respect to the applicable definitions and terms utilized as part of our risk ranking process: 


Degree of Risk and Priority of Action 


The degree of risk is unacceptable and either does or could pose a 
significant level of exposure to the organization. As such, immediate action 
is required by management in order to address the noted concern and 
reduce risks to the organization. 

Medium/High 

The degree of risk is substantially undesirable and either does or could pose 
a moderate to significant level of exposure to the organization. As such, 
prompt action by management is essential in order to address the noted 
concern and reduce risks to the organization. 

Medium 

The degree of risk is undesirable and either does or could pose a moderate 
level of exposure to the organization. As such, action is needed by 
management in order to address the noted concern and reduce risks to a 
more desirable level. 

Low 

The degree of risk appears reasonable; however, opportunities exist to further 
reduce risks through improvement of existing policies, procedures, and/or 
operations. As such, action should be taken by management to address the 
noted concern and reduce risks to the organization. 


Risk Definition - The degree 
of risk that exists based upon 
the identified deficiency 
combined with the 
subsequent priority of action 
to be undertaken by 
management. 


It is important to note that considerable professional judgment is required in determining the overall ratings presented on the subsequent 
pages of this report. Accordingly, others could evaluate the results differently and draw different conclusions. 

It is also important to note that this report provides management with information about the condition of risks and internal controls at one 
point in time. Future changes in environmental factors and actions by personnel may significantly and adversely impact these risks and 
controls in ways that this report did not and cannot anticipate. 
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